PRIVACY POLICY

Effective as of 1 Sep 2026

This Privacy Policy explains how SuppFit, operating supp.fit (“supp.fit”, “we”, “us” or “our”), collects, uses, shares, stores, and protects personal information when you use:

• the website located at supp.fit and its subdomains;
• our mobile applications; and
• our related services and features,

collectively, the “Services”.

Some information you choose to provide through the Services may relate to your health. We process this information as described below.

1. Who Is Responsible for Your Personal Data

SuppFit is responsible for the processing of personal data described in this Privacy Policy unless otherwise stated.

For purposes of the General Data Protection Regulation (“GDPR”), the UK GDPR, and other applicable data protection laws, SuppFit acts as the data controller where it determines the purposes and means of processing your personal data.

You can contact us about privacy matters at:

support@supp.fit

2. Personal Data We Collect

The information we collect depends on how you use the Services.

2.1. Account and Contact Information

We may collect information such as:

• your name or preferred name;
• email address;
• username;
• date or year of birth;
• country or region;
• language;
• time zone;
• authentication identifiers; and
• other information you choose to provide in your Account.

If you sign in using Apple, Google, or another authentication provider, we may receive information made available by that provider, such as your name, email address, account identifier, or profile information.

2.2. Supplement and Health-Related Information

Depending on the features you use, you may choose to provide information such as:

• supplements you use or are considering;
• supplement names, ingredients, dosages, schedules, or routines;
• health and wellness goals;
• dietary preferences;
• allergies or sensitivities;
• health conditions or symptoms you choose to disclose;
• medications or other products you choose to disclose;
• age;
• sex or gender, where relevant to a feature you use;
• pregnancy or breastfeeding status, where relevant to a feature you use; and
• other health-related information you voluntarily provide.

We may also generate or infer health-related information from information you provide where necessary to provide functionality you request.

Some of this information may constitute health data, sensitive personal information, special category personal data, or consumer health data under applicable law.

We do not ask you to provide information about your sex life, sexual orientation, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic data, or similar highly sensitive information unless a specific feature requires it and we provide appropriate notice and obtain any consent required by law.

However, if you voluntarily include such information in a free-text field, AI interaction, or support request, we may process it as part of the information you submitted.

Please do not provide sensitive information that is not necessary for your use of the Services.

2.3. AI Interaction Data

When you use AI-enabled features, we may process:

• prompts;
• questions;
• messages;
• instructions;
• information you choose to include in those interactions;
• relevant Account or health-related information necessary to respond to your request;
• responses associated with your Account;
• feedback about generated responses; and
• technical information associated with those interactions.

Your prompts may contain health-related or other sensitive information if you choose to include it.

2.4. Usage Information

We may collect information about how you use the Services, such as:

• pages or screens you view;
• searches you perform;
• content you view or save;
• features you use;
• buttons or links you select;
• access times and duration;
• navigation paths;
• Application launches;
• subscription interactions;
• errors and crashes; and
• other interactions with the Services.

Depending on the context, your searches or activity may reveal information about your health interests.

2.5. Device and Technical Information

We or our service providers may automatically collect information such as:

• device type and model;
• operating system and version;
• browser type and version;
• Application version;
• IP address;
• device or application identifiers;
• language settings;
• time zone;
• mobile carrier;
• network information;
• general geographic information derived from your IP address;
• crash information;
• diagnostic information; and
• security-related information.

We do not collect precise geographic location unless a specific feature requires it and you grant the required permission.

2.6. Subscription and Transaction Information

If you purchase or manage a Subscription, we may receive information such as:

• subscription type;
• subscription status;
• purchase and renewal dates;
• price and currency;
• product identifier;
• transaction identifier;
• payment provider or application store;
• cancellation status; and
• refund status.

Payment information may be collected directly by providers such as the Apple App Store, Google Play, Stripe, or another payment provider.

We generally do not receive or store your complete payment card number when payment is processed directly by those providers.

2.7. Communications and Support

If you contact us, we may collect:

• your name;
• email address;
• Account information;
• the content of your communication;
• support requests;
• feedback;
• complaints;
• attachments; and
• other information necessary to respond to you.

3. How We Collect Personal Data

We may collect personal data:

Directly from you

For example, when you create an Account, enter information, use AI features, purchase a Subscription, or contact us.

Automatically

For example, device, usage, security, diagnostic, and analytics information generated when you use the Services.

From third-party services

For example:

• Apple or Google authentication;
• application stores;
• payment providers;
• subscription-management services; and
• service providers that help operate the Services.

4. How We Use Personal Data

We may use personal data to:

4.1. Provide the Services

Including to:

• create and maintain your Account;
• authenticate you;
• provide features you request;
• respond to AI interactions;
• personalize requested functionality;
• maintain saved information or history;
• manage Subscriptions;
• process transactions;
• provide customer support; and
• send important service communications.

4.2. Maintain Safety and Security

Including to:

• prevent unauthorized access;
• detect fraud and abuse;
• investigate suspicious activity;
• protect Accounts;
• diagnose technical issues;
• identify security vulnerabilities; and
• protect the integrity of the Services.

4.3. Improve the Services

We may use personal data to:

• understand how the Services are used;
• identify technical problems;
• measure performance;
• improve usability;
• evaluate feature quality;
• improve AI-generated results;
• develop new features; and
• conduct internal research and development.

Where this involves health data or other special category personal data, we use an appropriate legal basis and additional legal condition where required.

4.4. Communicate With You

We may use your contact information to:

• respond to requests;
• provide support;
• send security alerts;
• send Account or Subscription notices;
• notify you of important changes; and
• send other administrative communications.

Where permitted by law, we may also send marketing communications.

4.5. Comply With Law and Protect Rights

We may process personal data to:

• comply with applicable laws;
• respond to lawful legal process;
• enforce our Terms of Use;
• prevent or investigate violations;
• establish, exercise, or defend legal claims;
• protect our rights and property; and
• protect users or other individuals.

4.6. Create De-Identified Information

We may aggregate, anonymize, or de-identify information so that it cannot reasonably be used to identify you.

We may use such information for:

• analytics;
• statistics;
• research and development;
• product improvement;
• AI evaluation; and
• business planning.

Where required by law, we will maintain de-identified information in de-identified form and will not attempt to re-identify it except as permitted by law.

5. Legal Bases for Processing in the EEA and UK

If you are located in the EEA or United Kingdom, we process personal data only when we have an appropriate lawful basis.

5.1. Contract

We may process personal data where necessary to provide Services you request, including managing your Account, providing features, managing your Subscription, and providing support.

5.2. Consent

We rely on consent where required, including for certain:

• health-data processing;
• other special category data;
• marketing communications;
• non-essential cookies;
• advertising technologies; and
• optional features.

You may withdraw consent at any time.

Withdrawal does not affect processing performed lawfully before consent was withdrawn.

5.3. Health and Other Special Category Data

Certain information you provide may constitute special category personal data under the GDPR or UK GDPR.

Where we process such information, we rely on an applicable condition under Article 9 of the GDPR or UK GDPR in addition to an Article 6 lawful basis.

Where appropriate or required, we rely on your explicit consent.

If you voluntarily include special category personal data in a free-text submission, we process it only as necessary to handle that submission and for other purposes permitted by applicable law.

5.4. Legitimate Interests

We may process personal data where necessary for legitimate interests such as:

• operating and improving the Services;
• maintaining security;
• preventing fraud;
• diagnosing technical problems;
• responding to support requests;
• understanding Service usage; and
• establishing or defending legal claims.

We consider the impact of such processing on your rights and interests.

5.5. Legal Obligations

We may process personal data where necessary to comply with applicable legal obligations.

6. AI Service Providers

We may use third-party artificial intelligence, machine-learning, cloud, search, or other technical providers to operate AI-enabled features.

Where necessary to provide a feature, these providers may process:

• your prompt or message;
• information you include in your prompt;
• relevant context necessary to respond;
• relevant health-related information where necessary for the request; and
• associated technical information.

Where providers process personal data on our behalf, we use contractual and organizational measures designed to protect that information as required by applicable law.

We seek to limit information provided to such service providers to what is reasonably necessary to provide or support the requested feature.

We do not sell identifiable AI interaction data.

We do not disclose identifiable health information for third-party targeted advertising.

7. How We Share Personal Data

We may share personal data with the following categories of recipients.

7.1. Service Providers

Companies that help us operate the Services, including providers of:

• cloud hosting;
• databases;
• artificial intelligence;
• authentication;
• customer support;
• email delivery;
• analytics;
• crash reporting;
• security;
• fraud prevention;
• subscription management; and
• payment services.

7.2. Payment Providers and Application Stores

Payment and Subscription information may be processed by providers such as:

• Apple;
• Google;
• Stripe; or
• another payment provider.

Their processing of information is also subject to their own privacy policies.

7.3. Authentication Providers

If you sign in through Apple, Google, or another provider, we may exchange information necessary to authenticate your Account.

7.4. Professional Advisers

We may disclose information where necessary to lawyers, accountants, auditors, insurers, and other professional advisers.

7.5. Authorities

We may disclose information where required or permitted by law, including in response to valid legal process or where necessary to protect rights, safety, or property.

7.6. Business Transactions

Personal data may be disclosed or transferred in connection with an actual or proposed:

• merger;
• acquisition;
• financing;
• sale of assets;
• corporate reorganization;
• insolvency; or
• similar business transaction.

7.7. At Your Direction

We may share information with another party where you instruct us to do so or provide consent.

8. Sale and Advertising

We do not sell personal data for money.

We do not sell health-related information to data brokers.

We do not disclose identifiable health information for third-party targeted advertising.

We may use non-health technical or attribution information to understand how users discover the Services and measure marketing performance, subject to applicable law and consent requirements.

Where applicable law gives you a right to opt out of sale, sharing, or targeted advertising, we will provide a method to exercise that right.

9. Cookies and Similar Technologies

We may use:

• cookies;
• SDKs;
• local storage;
• pixels;
• web beacons; and
• similar technologies.

They may be used for:

• authentication;
• security;
• remembering preferences;
• providing functionality;
• analytics; and
• marketing attribution where permitted.

Where required by law, we obtain consent before using non-essential technologies.

You may be able to control these technologies through:

• our privacy settings;
• a cookie consent interface;
• browser settings;
• device settings; or
• operating-system controls.

10. Mobile Application Permissions

The Application may request device permissions necessary to provide features you choose to use.

Depending on the feature, this may include permission to:

• send push notifications;
• access a photo or file you select;
• use the camera; or
• access another device function.

You can generally grant or revoke permissions through your device settings.

If we engage in tracking subject to Apple’s AppTrackingTransparency framework, we will request the applicable permission before doing so.

11. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to:

• provide the Services;
• maintain your Account;
• maintain features or history requested by you;
• manage Subscriptions;
• comply with legal, tax, accounting, or regulatory requirements;
• prevent fraud;
• resolve disputes; and
• establish or defend legal claims.

Retention periods depend on factors including:

• the type of information;
• its sensitivity;
• the reason for processing it;
• whether you continue to use the Services;
• legal requirements; and
• the risks associated with retaining it.

If you delete your Account, we will delete or de-identify associated personal data in accordance with applicable law and our retention procedures, unless we need to retain certain information for legal, security, fraud-prevention, or compliance purposes.

Some information may remain temporarily in backups before being removed through normal backup rotation.

12. Security

We use technical and organizational measures designed to protect personal data from unauthorized access, disclosure, alteration, loss, or misuse.

Access to personal data is restricted to those who need it for legitimate business purposes.

No internet-based service or electronic storage system can be guaranteed to be completely secure.

If we become aware of a personal data breach, we will investigate it and provide notifications where required by applicable law.

You may report a security or privacy concern to:

support@supp.fit

13. International Data Transfers

Personal data may be transferred to and processed in countries other than the country where you live, including where our service providers operate.

Where the GDPR or UK GDPR applies and information is transferred to a country without an applicable adequacy decision, we use an appropriate transfer mechanism where required.

Such mechanisms may include:

• the European Commission’s Standard Contractual Clauses;
• the UK International Data Transfer Agreement;
• the UK Addendum to the European Commission’s Standard Contractual Clauses; or
• another lawful transfer mechanism.

For information about applicable international transfer safeguards, contact:

support@supp.fit

14. Your Privacy Rights

Depending on where you live, you may have the following rights.

14.1. Access

You may request information about personal data we process about you and obtain a copy.

14.2. Correction

You may request correction of inaccurate or incomplete personal data.

14.3. Deletion

You may request deletion of personal data, subject to exceptions under applicable law.

14.4. Restriction

You may have the right to request restriction of certain processing.

14.5. Objection

You may have the right to object to processing based on legitimate interests or to processing for direct marketing.

14.6. Data Portability

Where applicable, you may request certain personal data in a structured, commonly used, machine-readable format.

14.7. Withdrawal of Consent

Where we rely on consent, you may withdraw that consent at any time.

This includes explicit consent for processing health or other special category personal data where applicable.

14.8. Complaints

You may have the right to complain to an applicable privacy or data protection authority.

If you are located in the United Kingdom, you may have the right to complain to the Information Commissioner’s Office.

If you are located in the EEA, you may have the right to complain to your applicable supervisory authority.

15. How to Exercise Your Rights

To submit a privacy request, contact:

support@supp.fit

Please clearly describe your request.

We may need to verify your identity before fulfilling the request.

For example, we may ask you to submit the request using the email address associated with your Account or provide other information reasonably necessary to verify your identity.

We will respond within the period required by applicable law.

For requests under the GDPR or UK GDPR, this will normally be within one month, subject to permitted extensions.

Where allowed by law, we may refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive.

You will not be discriminated against for exercising applicable privacy rights.

16. Marketing Communications

You may unsubscribe from marketing emails using the unsubscribe link contained in the message.

You may still receive non-marketing communications, including:

• security alerts;
• Account notices;
• Subscription notices;
• transactional communications;
• legal notices; and
• responses to support requests.

Push notifications can generally be disabled through your device settings.

17. Children

The Services are intended for users who are 18 years of age or older.

We do not knowingly collect personal data through the Services from anyone under 18.

If you believe a person under 18 has provided personal information to us, contact:

support@supp.fit

If appropriate, we will take steps to delete the information in accordance with applicable law.

18. Consumer Health Data

Certain information processed through the Services may constitute “consumer health data” under U.S. state consumer health privacy laws.

This may include information about:

• supplement use;
• health conditions or symptoms;
• health goals;
• medications;
• allergies;
• pregnancy or breastfeeding status;
• health-related AI interactions; and
• health-related information inferred from other information you provide.

Where applicable Consumer Health Data Laws apply, additional information about our practices and your rights is provided in our separate Consumer Health Data Privacy Policy.

If there is a conflict between this Privacy Policy and the Consumer Health Data Privacy Policy concerning Consumer Health Data, the Consumer Health Data Privacy Policy will apply to the extent required by applicable law.

19. U.S. State Privacy Rights

Residents of certain U.S. states may have additional privacy rights.

Depending on applicable law, these may include rights to:

• access personal information;
• obtain a copy;
• correct inaccurate information;
• request deletion;
• obtain data portability;
• opt out of certain sales or sharing;
• opt out of targeted advertising;
• limit certain uses of sensitive information; and
• appeal certain privacy-request decisions.

Requests may be submitted to:

support@supp.fit

For purposes of applicable U.S. privacy laws:

We do not sell personal information for monetary consideration.

We do not sell or share identifiable health information for cross-context behavioral advertising.

20. Third-Party Services

The Services may contain links to or integrate with third-party websites, applications, payment services, authentication providers, or other online services.

We do not control those third parties’ independent privacy practices.

Their collection and use of information is governed by their own privacy policies.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

When we do, we will update the Effective or Last Updated date.

If changes are material, we may provide additional notice through:

• the Website;
• the Application;
• email; or
• another appropriate method.

Where applicable law requires consent for a new processing activity, we will request that consent.

22. Contact Us

If you have questions, concerns, complaints, or requests regarding this Privacy Policy or our processing of personal data, contact:

SuppFit

Email: support@supp.fit